From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB0D5C43458 for ; Wed, 22 Jul 2020 15:53:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9E217208E4 for ; Wed, 22 Jul 2020 15:53:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1595433225; bh=5eJCV0Z/hSjdqvckepKd6JHihVEQ5bBMA871o1ru3k4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=dsrRf9snu+Xyn2etaq4iQZyqSjmQ+At5ijZRWiN4pNpRyeGOQiM5EcBwMIoAVvcrU n4jt5SJIUdjNC4TfS9Qa/a21H5nd88voOf58KMzMNjDhQDN1Mi2myt9z0MyWRkF4v8 LY4Lf9CRmrkT2/oLbWsJbRAIffxZqETSciUPTEa0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730870AbgGVPxp (ORCPT ); Wed, 22 Jul 2020 11:53:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:35894 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726427AbgGVPxp (ORCPT ); Wed, 22 Jul 2020 11:53:45 -0400 Received: from localhost.localdomain (cpc149474-cmbg20-2-0-cust94.5-4.cable.virginm.net [82.4.196.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AE769206F5; Wed, 22 Jul 2020 15:53:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1595433224; bh=5eJCV0Z/hSjdqvckepKd6JHihVEQ5bBMA871o1ru3k4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P+RmeCY8NGMEWXxLQ6LqX/No9e7k4jee+0gRhZjr7z06UuaTE6LlhV0RLbMgQ82B+ 1zRci3oB5grDkzy7g8I4IWlQ3qNbgU1HK8nLnu0Mf35/7/rSdCQXxl8STyhGHieTbP QFc32IZ0liJWJqq5IU/G46G+9qgUfPmC3ZEvE0N0= From: Jonathan Cameron To: linux-iio@vger.kernel.org Cc: Andy Shevchenko , Lars-Peter Clausen , Peter Meerwald , Jonathan Cameron , Akinobu Mita Subject: [PATCH v3 24/27] iio:adc:ti-adc0832 Fix alignment issue with timestamp Date: Wed, 22 Jul 2020 16:51:00 +0100 Message-Id: <20200722155103.979802-25-jic23@kernel.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200722155103.979802-1-jic23@kernel.org> References: <20200722155103.979802-1-jic23@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-iio-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org From: Jonathan Cameron One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. We fix this issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak apart from previous readings. Note that previously no data could leak 'including' previous readings but I don't think it is an issue to potentially leak them like this now does. In this case the postioning of the timestamp is depends on what other channels are enabled. As such we cannot use a structure to make the alignment explicit as it would be missleading by suggesting only one possible location for the timestamp. Fixes: 815bbc87462a ("iio: ti-adc0832: add triggered buffer support") Reported-by: Lars-Peter Clausen Cc: Akinobu Mita Signed-off-by: Jonathan Cameron --- drivers/iio/adc/ti-adc0832.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/iio/adc/ti-adc0832.c b/drivers/iio/adc/ti-adc0832.c index c7a085dce1f4..71d49f97ab9c 100644 --- a/drivers/iio/adc/ti-adc0832.c +++ b/drivers/iio/adc/ti-adc0832.c @@ -29,6 +29,8 @@ struct adc0832 { struct regulator *reg; struct mutex lock; u8 mux_bits; + /* 16x 1 byte ADC data + 8 bytes timestamp */ + u8 data[24] __aligned(8); u8 tx_buf[2] ____cacheline_aligned; u8 rx_buf[2]; @@ -200,7 +202,6 @@ static irqreturn_t adc0832_trigger_handler(int irq, void *p) struct iio_poll_func *pf = p; struct iio_dev *indio_dev = pf->indio_dev; struct adc0832 *adc = iio_priv(indio_dev); - u8 data[24] = { }; /* 16x 1 byte ADC data + 8 bytes timestamp */ int scan_index; int i = 0; @@ -218,10 +219,10 @@ static irqreturn_t adc0832_trigger_handler(int irq, void *p) goto out; } - data[i] = ret; + adc->data[i] = ret; i++; } - iio_push_to_buffers_with_timestamp(indio_dev, data, + iio_push_to_buffers_with_timestamp(indio_dev, adc->data, iio_get_time_ns(indio_dev)); out: mutex_unlock(&adc->lock); -- 2.27.0